CVE-2024-36886 PoC — tipc: fix UAF in error path

Source

https://github.com/abubakar-shahid/CVE-2024-36886

Associated Vulnerability

Title:tipc: fix UAF in error path (CVE-2024-36886)
Description:In the Linux kernel, the following vulnerability has been resolved: tipc: fix UAF in error path Sam Page (sam4k) working with Trend Micro Zero Day Initiative reported a UAF in the tipc_buf_append() error path: BUG: KASAN: slab-use-after-free in kfree_skb_list_reason+0x47e/0x4c0 linux/net/core/skbuff.c:1183 Read of size 8 at addr ffff88804d2a7c80 by task poc/8034 CPU: 1 PID: 8034 Comm: poc Not tainted 6.8.2 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-debian-1.16.0-5 04/01/2014 Call Trace: <IRQ> __dump_stack linux/lib/dump_stack.c:88 dump_stack_lvl+0xd9/0x1b0 linux/lib/dump_stack.c:106 print_address_description linux/mm/kasan/report.c:377 print_report+0xc4/0x620 linux/mm/kasan/report.c:488 kasan_report+0xda/0x110 linux/mm/kasan/report.c:601 kfree_skb_list_reason+0x47e/0x4c0 linux/net/core/skbuff.c:1183 skb_release_data+0x5af/0x880 linux/net/core/skbuff.c:1026 skb_release_all linux/net/core/skbuff.c:1094 __kfree_skb linux/net/core/skbuff.c:1108 kfree_skb_reason+0x12d/0x210 linux/net/core/skbuff.c:1144 kfree_skb linux/./include/linux/skbuff.h:1244 tipc_buf_append+0x425/0xb50 linux/net/tipc/msg.c:186 tipc_link_input+0x224/0x7c0 linux/net/tipc/link.c:1324 tipc_link_rcv+0x76e/0x2d70 linux/net/tipc/link.c:1824 tipc_rcv+0x45f/0x10f0 linux/net/tipc/node.c:2159 tipc_udp_recv+0x73b/0x8f0 linux/net/tipc/udp_media.c:390 udp_queue_rcv_one_skb+0xad2/0x1850 linux/net/ipv4/udp.c:2108 udp_queue_rcv_skb+0x131/0xb00 linux/net/ipv4/udp.c:2186 udp_unicast_rcv_skb+0x165/0x3b0 linux/net/ipv4/udp.c:2346 __udp4_lib_rcv+0x2594/0x3400 linux/net/ipv4/udp.c:2422 ip_protocol_deliver_rcu+0x30c/0x4e0 linux/net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x2e4/0x520 linux/net/ipv4/ip_input.c:233 NF_HOOK linux/./include/linux/netfilter.h:314 NF_HOOK linux/./include/linux/netfilter.h:308 ip_local_deliver+0x18e/0x1f0 linux/net/ipv4/ip_input.c:254 dst_input linux/./include/net/dst.h:461 ip_rcv_finish linux/net/ipv4/ip_input.c:449 NF_HOOK linux/./include/linux/netfilter.h:314 NF_HOOK linux/./include/linux/netfilter.h:308 ip_rcv+0x2c5/0x5d0 linux/net/ipv4/ip_input.c:569 __netif_receive_skb_one_core+0x199/0x1e0 linux/net/core/dev.c:5534 __netif_receive_skb+0x1f/0x1c0 linux/net/core/dev.c:5648 process_backlog+0x101/0x6b0 linux/net/core/dev.c:5976 __napi_poll.constprop.0+0xba/0x550 linux/net/core/dev.c:6576 napi_poll linux/net/core/dev.c:6645 net_rx_action+0x95a/0xe90 linux/net/core/dev.c:6781 __do_softirq+0x21f/0x8e7 linux/kernel/softirq.c:553 do_softirq linux/kernel/softirq.c:454 do_softirq+0xb2/0xf0 linux/kernel/softirq.c:441 </IRQ> <TASK> __local_bh_enable_ip+0x100/0x120 linux/kernel/softirq.c:381 local_bh_enable linux/./include/linux/bottom_half.h:33 rcu_read_unlock_bh linux/./include/linux/rcupdate.h:851 __dev_queue_xmit+0x871/0x3ee0 linux/net/core/dev.c:4378 dev_queue_xmit linux/./include/linux/netdevice.h:3169 neigh_hh_output linux/./include/net/neighbour.h:526 neigh_output linux/./include/net/neighbour.h:540 ip_finish_output2+0x169f/0x2550 linux/net/ipv4/ip_output.c:235 __ip_finish_output linux/net/ipv4/ip_output.c:313 __ip_finish_output+0x49e/0x950 linux/net/ipv4/ip_output.c:295 ip_finish_output+0x31/0x310 linux/net/ipv4/ip_output.c:323 NF_HOOK_COND linux/./include/linux/netfilter.h:303 ip_output+0x13b/0x2a0 linux/net/ipv4/ip_output.c:433 dst_output linux/./include/net/dst.h:451 ip_local_out linux/net/ipv4/ip_output.c:129 ip_send_skb+0x3e5/0x560 linux/net/ipv4/ip_output.c:1492 udp_send_skb+0x73f/0x1530 linux/net/ipv4/udp.c:963 udp_sendmsg+0x1a36/0x2b40 linux/net/ipv4/udp.c:1250 inet_sendmsg+0x105/0x140 linux/net/ipv4/af_inet.c:850 sock_sendmsg_nosec linux/net/socket.c:730 __sock_sendmsg linux/net/socket.c:745 __sys_sendto+0x42c/0x4e0 linux/net/socket.c:2191 __do_sys_sendto linux/net/socket.c:2203 __se_sys_sendto linux/net/socket.c:2199 __x64_sys_sendto+0xe0/0x1c0 linux/net/socket.c:2199 do_syscall_x64 linux/arch/x86/entry/common.c:52 do_syscall_ ---truncated---

Readme

# N-Day Vulnerability Research

## Overview
This project focuses on **N-Day vulnerabilities** in the Linux kernel, with an emphasis on understanding their lifecycle, analyzing their impact, and exploring mitigation strategies. N-Day vulnerabilities are publicly disclosed flaws that remain unpatched on many systems, making them high-value targets for attackers.  

The research investigates a specific Linux kernel subsystem and evaluates a real-world vulnerability (**CVE-2024-36886**), demonstrating its security implications and stressing the importance of timely patch management.

---

## Objectives
- Conduct a **comprehensive analysis** of Linux kernel subsystems and their potential vulnerabilities.  
- Study **N-Day vulnerabilities** using publicly available advisories and vulnerability databases.  
- Assess the **real-world impact** of delayed patching.  
- Explore the role of **automated tools and frameworks** in vulnerability discovery.  
- Provide **recommendations** for patch management and mitigation strategies.  

---

## Research Scope
- **Linux Kernel Subsystem Focus**: Networking subsystem with an emphasis on the TIPC (Transparent Inter-Process Communication) protocol.  
- **Vulnerability Lifecycle Analysis**: From discovery to disclosure, patching, and exploitation risks.  
- **Real-World Case Studies**: Examples of N-Day vulnerabilities, their exploitation, and organizational impact.  
- **Optional Exploration**: Zero-Day research and its relation to N-Day vulnerabilities.  

---

## Methodology
1. **Literature Review**: Analysis of prior research on Linux kernel vulnerabilities.  
2. **Subsystem Analysis**: Study of kernel components such as memory, process, filesystem, networking, and device drivers.  
3. **Vulnerability Identification**: Using static/dynamic analysis, fuzzing, and community vulnerability databases.  
4. **Case Study**: Examination of CVE-2024-36886 to understand its severity, root cause, and patching timeline.  
5. **Mitigation Strategies**: Recommendations for patching, secure coding practices, and proactive defense mechanisms.  

---

## Key Findings
- N-Day vulnerabilities remain a major threat due to **delayed patching** across organizations.  
- The **Linux kernel** is a high-value target because of its widespread use in servers, cloud, mobile, and embedded systems.  
- Case studies such as **Dirty COW (CVE-2016-5195)** highlight how unpatched vulnerabilities lead to privilege escalation and system compromise.  
- Automated tools like **Metasploit, Nessus, OpenVAS, AFL, and Valgrind** play a critical role in vulnerability research and mitigation.  

---

## Contributions
- Improved **understanding of kernel-level vulnerabilities**.  
- Analysis of **CVE-2024-36886** and its implications on Linux networking security.  
- Recommendations for **timely patch deployment** and **proactive security measures**.  
- Contribution to ongoing efforts in **vulnerability management and secure practices** within the Linux ecosystem.  

---

## Future Work
- Extending research into **Zero-Day vulnerabilities** and their relation to N-Day threats.  
- Further exploration of **automated exploit development frameworks**.  
- Development of advanced **patch management strategies** for critical systems.  

---

## Authors
- Muhammad Danial Tahir (21L-5831)  
- Abu Bakar Shahid (21L-5845)  
- Muhammad Junaid (21L-6064)  

**Supervisor**: Dr. Arshad Ali  
National University of Computer and Emerging Sciences, Lahore  
April 2025

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →